@anonympins/fingerprint 0.0.4 → 0.0.6

package/README.md

@@ -19,6 +19,8 @@ The process unfolds in three steps:
     *   **Device Behavior**: Rapid fingerprint changes (User-Agent rotation).
     *   **IP Behavior**: An excessive number of different devices seen from the same IP, or a single device using a large number of IPs (proxy rotation).
     *   **Inconsistency**: A low similarity score between the current fingerprint and the initial one associated with the `device_id` (cookie theft detection).
+    *   **Request Patterns**: Repetitive, rapid-fire, or sequential requests typical of scraping bots. The parameters for detecting these patterns (e.g., request velocity, burst detection) are dynamically adjusted by the auto-tuner for optimal performance.
+    *   **Honeypot Trap**: Detection of bots that automatically fill hidden form fields or probe for common but unused URL parameters (e.g., `?debug=true`).
 3.  **Dynamic Challenge**: If the suspicion score exceeds a certain threshold, a challenge is presented to the user. The difficulty and type of challenge depend on the score:
     *   **Low to Medium Suspicion**: A combined CPU and Memory Proof-of-Work (PoW) challenge is issued. The difficulty of both the CPU (hash calculation) and Memory (allocation and computation) components scales progressively with the suspicion score. For low scores, the memory challenge is negligible, making it primarily a CPU task.
     *   **High Suspicion**: For the most suspicious requests, the system issues a high-difficulty combined CPU/Memory challenge. The architecture allows for plugging in more complex challenges like CAPTCHAs if needed.
@@ -32,7 +34,7 @@ Once the challenge is solved, a clearance "ticket" is issued via a secure cookie
 -   **Pluggable Datastore**: Supports external datastores like Redis for state persistence and scalability across multiple server instances.
 -   **Express.js Middleware**: Easy integration into an Express application with `powMiddleware`. The datastore must support setting a Time-To-Live (TTL) for challenge secrets.
 -   **Timing Attack Protection**: Uses `crypto.timingSafeEqual` for secure ticket validation.
--   **Automatic Threshold Tuning**: Includes a genetic algorithm-based optimizer (`startThresholdAutoTuning`) that analyzes real traffic to dynamically adjust suspicion thresholds (`low`, `medium`, `high`), improving bot detection accuracy and reducing false positives over time.
+-   **Automatic Parameter Tuning**: Includes a genetic algorithm-based optimizer (`startThresholdAutoTuning`) that analyzes real traffic to dynamically adjust not only suspicion thresholds (`low`, `medium`, `high`) but also the parameters for behavioral pattern detection, improving accuracy and reducing false positives over time.
 
 ## Installation and Usage
 
@@ -40,7 +42,7 @@ This module is designed for a Node.js environment.
 
 ### Prerequisites
 
-Ensure you have a cookie-parser middleware (like `cookie-parser`) set up in your Express application.
+Ensure you have middleware for parsing cookies (like `cookie-parser`) and request bodies (like `express.json` and `express.urlencoded`) set up in your Express application *before* the `powMiddleware`.
 
 ### Configuration
 
@@ -56,11 +58,18 @@ The `powMiddleware` requires a configuration object defining the weights of susp
 
 ```javascript
 import express from 'express';
+import bodyParser from 'body-parser';
 import cookieParser from 'cookie-parser';
 import { powMiddleware /*, configurePow */ } from './fingerprint.js'; // Adjust the path
 
 const app = express();
 app.use(cookieParser());
+app.use(bodyParser.json()); // For parsing application/json
+app.use(bodyParser.urlencoded({ extended: true })); // For parsing application/x-www-form-urlencoded
+
+// Array to store traffic analysis data for the auto-tuner.
+// In a real application, this could be a more robust logging system (e.g., writing to a file or a database).
+const trafficData = [];
 
 // Configuration of weights and thresholds for calculating the suspicion score.
 // These values should be adjusted based on traffic and expected user behavior.
@@ -69,7 +78,9 @@ const securityConfig = {
         historyScore: 0.3,       // Penalizes IP rotation (proxy)
         rotationScore: 0.5,      // Penalizes rapid fingerprint changes (user-agent, etc.)
         headerAnomalyScore: 0.1, // Penalizes abnormal headers (missing UA, etc.)
-        inconsistencyScore: 0.8  // Strongly penalizes inconsistency between the current and initial fingerprint (stolen cookie)
+        requestPatternScore: 0.6,// Penalizes bot-like request sequences (scraping, etc.)
+        inconsistencyScore: 0.8, // Strongly penalizes inconsistency between the current and initial fingerprint (stolen cookie)
+        honeypotScore: 1.0       // Strongly penalizes bots filling hidden form fields
     },
     thresholds: {
         low: 20,    // Score from which a CPU challenge is issued
@@ -77,7 +88,32 @@ const securityConfig = {
         high: 75,   // Score for a very difficult challenge
         block: 95,  // Score above which the request is blocked outright (HTTP 403)
         isStaticResource: (req) => req.path.startsWith('/static/') // Optional: Custom function to identify static resources
-    }
+    },
+    patterns: { // (Optional) Initial values for request pattern detection, optimized by auto-tuner if enabled.
+        velocityThreshold: 200, // ms between requests to be considered "fast"
+        burstThreshold: 500,    // ms for identical requests to be a "burst"
+        scrapeThreshold: 1000,  // ms for sequential requests to be "scraping"
+        historySize: 10,        // Number of requests to keep for pattern analysis
+        decayFactor: 0.9,       // How quickly the pattern score decays over time
+    },
+    honeypot: {
+        // List of field names that are traps for bots.
+        // These should be hidden in forms for humans, or be URL parameters your app never uses.
+        fields: ['email_confirm', 'user_nickname', 'debug', 'test_mode', 'admin'], // (Optional)
+        // List of URL paths that should never be accessed by a legitimate user.
+        // A request to one of these paths will immediately flag the device as malicious.
+        trapUrls: ['/wp-admin', '/.env', '/admin.php', '/phpmyadmin'], // (Optional)
+        // Automatically detect common SQL/NoSQL injection and RCE patterns in request values. (Optional, default: true)
+        detectInjections: true
+    },
+    // The logger is required for auto-tuning. It collects data on requests.
+    logger: (log) => trafficData.push(log),
+    // (Optional) Configuration for the automatic threshold and pattern tuning.
+    autotuning: {
+        trafficData: trafficData,       // The data source for the genetic algorithm.
+        interval: 1800000,              // Optimization cycle every 30 minutes (in ms).
+        minDataPoints: 200              // Minimum requests before starting an optimization cycle.
+    },
 };
 
 // Create an instance of the middleware with your security configuration.
@@ -253,42 +289,6 @@ const server = http.createServer(async (req, res) => {
 server.listen(3000, () => console.log('Server with manual fingerprint engine started on port 3000'));
 ```
 
-### Automatic Threshold Tuning
-
-Manually setting the `low`, `medium`, and `high` thresholds can be challenging. This library provides a powerful tool to automate this process based on real traffic data. It uses a genetic algorithm to find the optimal thresholds that maximize bot detection while minimizing the impact on legitimate users.
-
-#### How to use it:
-
-1.  **Enable Logging**: The auto-tuner needs data. You must provide a `logger` function in your security configuration. This function will be called for significant events (`challenge_issued`, `challenge_solved`, etc.).
-
-2.  **Enable Auto-tuning**: Add an `autotuning` property to your security configuration. The middleware will automatically start the tuning process.
-
-```javascript
-import { powMiddleware } from './fingerprint.js';
-
-// Array to store traffic analysis data. In a real application, this could be
-// a more robust logging system.
-const trafficData = [];
-
-const securityConfig = {
-    weights: { /* ... */ },
-    thresholds: {
-        low: 20,    // Initial values, will be optimized
-        medium: 45,
-        high: 75
-    },
-    logger: (log) => trafficData.push(log), // The logger is required for auto-tuning
-    autotune: {
-        trafficData: trafficData,       // The data source for the algorithm
-        interval: 1800000,              // Optimization cycle every 30 minutes (optional)
-        minDataPoints: 200              // Minimum requests before starting optimization (optional)
-    }
-};
-
-const powMiddlewareInstance = powMiddleware(securityConfig);
-app.use(powMiddlewareInstance);
-```
-
 ---
 
 ## License

package/fingerprint.js

@@ -398,6 +398,219 @@ function getHeaderAnomalies(context) {
   };
 }
 
+/**
+ * Checks for submitted honeypot fields to detect bots.
+ * @param {object} context - The request context.
+ * @param {object} honeypotConfig - The honeypot configuration.
+ * @returns {{honeypotScore: number}}
+ */
+function getHoneypotScore(context, honeypotConfig = {}) {
+  const { fields = [], trapUrls = [], detectInjections = true } = honeypotConfig;
+
+  // 1. Check for trap URL access
+  if (trapUrls.some(trap => context.path.startsWith(trap))) {
+    return { honeypotScore: 100 };
+  }
+
+  if (fields.length === 0 && !detectInjections) {
+    return { honeypotScore: 0 };
+  }
+
+  // Check both query parameters (for URL probing) and the request body (for hidden form fields).
+  const queryData =
+    context.query instanceof URLSearchParams
+      ? Object.fromEntries(context.query.entries())
+      : context.query || {};
+  const bodyData = context.body || {};
+
+  // 2. Check for honeypot field names
+  for (const field of fields) {
+    // A bot is trapped if the field exists in either the query OR the body.
+    if (
+      Object.prototype.hasOwnProperty.call(queryData, field) ||
+      Object.prototype.hasOwnProperty.call(bodyData, field)
+    ) {
+      return { honeypotScore: 100 }; // A bot fell into the trap, maximum score.
+    }
+  }
+
+  // 3. Check for injection attempts in values
+  if (detectInjections) {
+    // Regex for common SQL injection patterns
+    // WARNING: These are generic and may cause false positives.
+    // Consider using a dedicated WAF library or more specific regex for your application.
+    const sqlRegex = new RegExp(
+      "('|\"|;|--|#|/\\*.*\\*/)|\\b(union|select|insert|update|delete|drop|truncate|from|where|and|or)\\b",
+      "i"
+    );
+    // Regex for common NoSQL (MongoDB) injection patterns (e.g., keys starting with '$')
+    // This looks for keys like "$where", "$ne", etc. in a stringified JSON.
+    const nosqlKeyRegex = /"\$(where|ne|gt|lt|in|nin)":/;
+    // Regex for common Remote Code Execution (RCE) patterns
+    const rceRegex = new RegExp(
+      // File traversal, command execution functions, and shell commands
+      // Added process, child_process to catch Node.js specific RCE.
+      "(\\.\\./|\\.\\.\\\\)|\\b(exec|system|shell_exec|passthru|popen|proc_open|eval|assert|require|include|process|child_process)(_once)?\\s*\\(|\\b(wget|curl|bash|sh|powershell|php)\\b",
+      "i"
+    );
+
+    const inspect = (obj) => {
+        for (const key in obj) {
+            if (Object.prototype.hasOwnProperty.call(obj, key)) {
+                const value = obj[key];
+                if (typeof value === 'string') {
+                    if (rceRegex.test(value) || sqlRegex.test(value)) return true;
+                } else if (typeof value === 'object' && value !== null) {
+                    // For NoSQL, we check the stringified version of the object to find keys like "$gt"
+                    // This is more accurate when done on the object itself.
+                    if (nosqlKeyRegex.test(JSON.stringify(value))) return true;
+                    if (inspect(value)) return true;
+                }
+            }
+        }
+        return false;
+    };
+
+    if (inspect(queryData)) {
+        return { honeypotScore: 100 };
+    }
+    if (inspect(bodyData)) {
+        return { honeypotScore: 100 };
+    }
+  }
+
+  return { honeypotScore: 0 };
+}
+
+/**
+ * Analyzes server-side request patterns for a given device to detect bot-like behavior.
+ * This is a stateful check that looks for repetitive or unnaturally fast requests.
+ * @param {object} context - The request context.
+ * @param {object} deviceData - The device's activity data from the store.
+ * @returns {{requestPatternScore: number}}
+ */
+function getRequestPatternScore(context, deviceData, patternConfig = {}) {
+    if (!deviceData) return { requestPatternScore: 0 };
+
+    // Default values for the pattern detection logic, which can be overridden by the auto-tuner.
+    const {
+        velocityThreshold = 200, velocityWeight = 30,
+        burstThreshold = 500, burstWeight = 50,
+        scrapeThreshold = 1000, scrapeWeight = 20, scrapeBurstWeight = 40,
+        historySize = 10,
+        decayFactor = 0.9,
+        inactivityReset = 30000
+    } = patternConfig;
+
+    const now = Date.now();
+    const currentPath = context.path;
+    // Make the function robust to handle both URLSearchParams and plain objects for query.
+    // Ensure query parameters are consistently handled, whether they come from a URLSearchParams object or a plain object.
+    const params = context.query instanceof URLSearchParams ? context.query : new URLSearchParams(context.query);
+    params.sort(); // Sort for deterministic order
+    const currentQueryString = params.toString();
+
+    // Initialize request history if it doesn't exist
+    if (!deviceData.requestHistory) {
+        deviceData.requestHistory = [];
+    }
+
+    const history = deviceData.requestHistory;
+    let score = 0;
+
+    // --- Analyze patterns based on the last few requests ---
+    if (history.length > 0) {
+        const lastRequest = history[history.length - 1];
+        const timeSinceLast = now - lastRequest.timestamp; // 150
+
+        // 1. Velocity Check: Penalize requests that are too fast to be human.
+        if (timeSinceLast < velocityThreshold) { // 150 < 200 -> true
+            score += velocityWeight; // score = 30
+        }
+
+        // 2. Burst Check: Add additional penalty for identical requests in a very short time frame.
+        if (currentPath === lastRequest.path && currentQueryString === lastRequest.queryString && timeSinceLast < burstThreshold) { // 150 < 500 -> true
+            score += burstWeight; // score = 30 + 50 = 80
+        }
+
+        // 3. Sequential Scraping Check: Add additional penalty for same path with different query params (potential scraping).
+        // This is a simplified check, now independent of the burst check.
+        if (currentPath === lastRequest.path && currentQueryString !== lastRequest.queryString && timeSinceLast < scrapeThreshold) {
+            const previousRequest = history.length > 2 ? history[history.length - 2] : null;
+            if (previousRequest && previousRequest.path === currentPath) {
+                score += scrapeBurstWeight; // This is at least the 3rd request in a sequence to the same path.
+            } else {
+                score += scrapeWeight; // First sign of a potential scraping pattern
+            }
+        }
+    }
+
+    // --- Update history ---
+    history.push({
+        timestamp: now,
+        path: currentPath,
+        queryString: currentQueryString,
+    });
+
+    // Keep history to a reasonable size (e.g., last 10 requests)
+    if (history.length > historySize) {
+        history.shift();
+    }
+
+    // Decay the score over time if behavior becomes normal again.
+    // We can store the score in deviceData and decay it.
+    deviceData.lastPatternScore = (deviceData.lastPatternScore || 0) * decayFactor + score; // Decay old score and add new
+
+    // If there hasn't been a request in a while, reset the pattern score.
+    if (history.length > 1 && (now - history[history.length - 2].timestamp > inactivityReset)) { // X ms inactivity
+        deviceData.lastPatternScore = 0;
+    }
+
+    return { requestPatternScore: Math.min(100, deviceData.lastPatternScore) };
+}
+
+const trapUrlTemplates = [
+    '/includes/config-{RANDOM}.php',          // Classic PHP config file
+    '/.env.{RANDOM}',                         // Environment file
+    '/backups/db_backup_{RANDOM}.sql.gz',     // Database backup
+    '/api/v1/internal/status?trace={RANDOM}', // Internal API endpoint
+    '/_private/deploy_key_{RANDOM}.pem',      // Private key file
+    '/logs/app_error_{RANDOM}.log',           // Log file
+    '/.git/config_{RANDOM}'                   // Exposed git config variant
+];
+
+/**
+ * Generates a signed trap URL.
+ * @param {string} nonce - The nonce to sign the URL with.
+ * @returns {string} The trap URL.
+ */
+function generateTrapUrl(nonce) {
+    // Pick a random template to diversify the traps
+    const template = trapUrlTemplates[Math.floor(Math.random() * trapUrlTemplates.length)];
+    const randomPart = crypto.randomBytes(8).toString('hex');
+    const path = template.replace('{RANDOM}', randomPart);
+
+    const signature = crypto.createHmac('sha256', getPowSecret()).update(nonce + path).digest('hex').substring(0, 16);
+    return `${path}?sig=${signature}`;
+}
+
+/**
+ * Verifies if a given path is a valid trap URL for a given nonce.
+ * @param {string} path - The request path.
+ * @param {string} signature - The signature from the query.
+ * @param {string} nonce - The nonce to verify against.
+ * @returns {boolean}
+ */
+function verifyTrapUrl(path, signature, nonce) {
+    const expectedSignature = crypto.createHmac('sha256', getPowSecret()).update(nonce + path).digest('hex').substring(0, 16);
+    try {
+        // Use timingSafeEqual to prevent timing attacks where an attacker could guess the signature byte by byte.
+        return crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expectedSignature, 'hex'));
+    } catch {
+        // This will catch errors if buffers have different lengths or contain invalid hex characters, which is a failure case.
+        return false;
+    }
+}
 /**
  * @typedef {object} IStore
  * @property {(key: string) => Promise<any>} get
@@ -443,7 +656,6 @@ async function resolveRequestIdentity(context) {
   let consistencyScore = 1.0; // 1.0 = perfectly consistent
   let deviceData = null;
   let newCookie = null;
-
   if (deviceId) {
     deviceData = await store.get(`device:${deviceId}`);
   }
@@ -474,6 +686,7 @@ async function resolveRequestIdentity(context) {
     deviceData = {
       initialDeviceHash: currentDeviceHash, // Anchor the initial fingerprint.
       ips: new Set(),
+      requestHistory: [], // Initialize state for the new pattern score
       lastUpdate: Date.now(),
       lastFpHash: currentDeviceHash,
       lastChangeTimestamp: 0,
@@ -545,10 +758,10 @@ async function getBehavioralIndicators(context, deviceData) {
 /**
  * Returns a vector of raw (unweighted) suspicion scores.
  * @param {object} context - The request context object.
- * @returns {Promise<{historyScore: number, rotationScore: number, headerAnomalyScore: number, inconsistencyScore: number}>}
+ * @returns {Promise<{historyScore: number, rotationScore: number, headerAnomalyScore: number, inconsistencyScore: number, honeypotScore: number}>}
  */
-export const getSuspicionVector = async (context) => {
-  const { deviceId, deviceData, consistencyScore, newCookie } = await resolveRequestIdentity(context);
+export const getSuspicionVector = async (context, securityConfig) => {
+    const { deviceId, deviceData, consistencyScore, newCookie } = await resolveRequestIdentity(context);
 
   const clientIp = context.clientIp;
 
@@ -570,10 +783,11 @@ export const getSuspicionVector = async (context) => {
   const behavioral = await getBehavioralIndicators(context, deviceData);
   const { headerAnomalyScore } = getHeaderAnomalies(context);
   // Calculate the inconsistency score here, separately.
-  const inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200));
+  const inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200)); // Amplified score
 
 
   // Save the updated device state to the store
+  // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
   await store.set(`device:${deviceId}`, deviceData);
 
   return { ...behavioral, headerAnomalyScore, inconsistencyScore };
@@ -595,17 +809,20 @@ const MAX_RAPID_CHANGES_PER_DEVICE = 3; // Number of rapid fingerprint changes a
  * Uses FingerprintBuilder to create a fingerprint based on headers
  * and IP, making spoofing more complex (requires changing the entire stack).
  */
-export const identifyRequest = async (req, res) => {
+export const identifyRequest = (securityConfig) => async (req, res) => {
   // This function now acts as a lightweight wrapper around the engine's identifyRequest method.
   // It requires a default configuration to work.
-  const defaultConfig = {
-    weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.1, inconsistencyScore: 0.8 },
-    thresholds: { low: 20, medium: 40, high: 75 }
+  const config = securityConfig || {
+    weights: { historyScore: 0.3, rotationScore: 0.5, headerAnomalyScore: 0.1, inconsistencyScore: 0.8, honeypotScore: 1.0 },
+    thresholds: { low: 20, medium: 40, high: 75 },
+    honeypot: { fields: [] } // Ensure honeypot config exists to prevent errors
   };
-  const engine = new FingerprintEngine(defaultConfig);
+  const engine = new FingerprintEngine(config);
 
   const requestContext = {
       clientIp: req.ip || req.socket?.remoteAddress || "unknown",
+      query: req.query,
+      body: req.body,
       cookies: req.cookies,
       headers: req.headers,
       rawHeaders: req.rawHeaders,
@@ -744,9 +961,9 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
             await new Promise(r => setTimeout(r, 10)); // Yield to update UI
 
             let memSolution = 0;
-            const iterations = size / 16;
             try {
                 const size = ${memoryDifficulty} * 1024 * 1024;
+                const iterations = size / 16;
                 const buffer = new Uint32Array(size / 4);
                 const seed = nonce + ":" + clientSecret;
                 let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
@@ -816,22 +1033,51 @@ class FingerprintEngine {
 
   async processRequest(requestContext) {
     const { clientIp, path, cookies, query, isStatic } = requestContext;
-    const { weights, thresholds, logger } = this.securityConfig;
+    const { weights, thresholds, logger, onDeviceCompromised } = this.securityConfig;
 
     if (isStatic) {
       return { action: 'next', score: 0, vector: {} };
     }
 
+    const { pow_nonce } = query;
+
+    // Honeypot: Direct probing of challenge endpoints is highly suspicious.
+    // A legitimate user only hits these endpoints via the challenge page itself, which is only served to suspicious users.
+    // If we see a pow_nonce on a request that isn't (yet) considered suspicious, it's a bot.
+    // We check this early, before the main suspicion calculation.
+    if (pow_nonce) {
+        const powCookie = cookies?.pow_clearance;
+        if (!isTicketValid(clientIp, powCookie)) { // Only check if there's no valid ticket
+            // This is a potential probe. We'll let the main logic confirm if it's not a legitimate challenge response.
+        }
+    }
+
+    // Check for persisted "condemned" status early.
+    const { deviceData } = await resolveRequestIdentity(requestContext);
+    if (deviceData?.condemned) {
+        if (onDeviceCompromised) {
+            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
+        }
+        return { action: 'block', status: 403, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+    }
+
     // The engine now works with the context directly, no more rawReq dependency here.
-    const suspicionVector = await __internal.getSuspicionVector(requestContext);
+    const suspicionVector = await __internal.getSuspicionVector(requestContext, this.securityConfig);
+    const { honeypotScore } = getHoneypotScore(requestContext, this.securityConfig.honeypot);
+    const { requestPatternScore } = getRequestPatternScore(requestContext, deviceData, this.securityConfig.patterns);
+    suspicionVector.honeypotScore = honeypotScore;
+    suspicionVector.requestPatternScore = requestPatternScore;
 
     const finalScore =
       suspicionVector.historyScore * (weights.historyScore || 0) +
       suspicionVector.rotationScore * (weights.rotationScore || 0) +
-      suspicionVector.headerAnomalyScore * (weights.headerAnomalyScore || 0) +
-      suspicionVector.inconsistencyScore * (weights.inconsistencyScore || 0);
+      suspicionVector.headerAnomalyScore * (weights.headerAnomalyScore || 0) + suspicionVector.requestPatternScore * (weights.requestPatternScore || 0) +
+      suspicionVector.inconsistencyScore * (weights.inconsistencyScore || 0) +
+      honeypotScore * (weights.honeypotScore || 0);
+
+    const isBlocked = finalScore >= (thresholds.block || 95);
 
-    const isSuspiciousHigh = finalScore >= thresholds.high;
+    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
     const isSuspiciousMedium = finalScore >= thresholds.medium;
     const isSuspicious = finalScore >= thresholds.low;
 
@@ -843,7 +1089,39 @@ class FingerprintEngine {
         )
         : 0;
     const powCookie = cookies?.pow_clearance;
-    const { pow_type, pow_nonce, pow_solution, pow_solution_cpu, pow_solution_mem } = query;
+    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem } = query;
+
+    // Honeypot: Direct probing of challenge endpoints is highly suspicious.
+    // A legitimate user only hits these endpoints via the challenge page itself.
+    if (pow_nonce && !isSuspicious) {
+      if (logger) {
+          logger({ type: 'honeypot_probe', deviceId: cookies?.device_id, score: finalScore, path: path, timestamp: Date.now() });
+      }
+      suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
+      // Recalculate score and block immediately.
+      const newFinalScore = finalScore - (honeypotScore * (weights.honeypotScore || 0)) + (100 * (weights.honeypotScore || 0));
+      return { action: 'block', status: 403, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
+    }
+
+    // If the action is to block, we should still include the score and vector for logging/testing.
+    if (isBlocked) {
+      if (onDeviceCompromised) {
+        onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Score exceeded block threshold', score: finalScore, vector: suspicionVector });
+      }
+      return { action: 'block', status: 403, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+    }
+
+    // Honeypot: Check if the request is for a trap URL generated in a previous challenge.
+    // This requires a nonce from a *previous* challenge, which we can look up via the device ID.
+    const lastNonce = deviceData?.lastChallengeNonce;
+    if (lastNonce && query.sig && verifyTrapUrl(path, query.sig, lastNonce)) {
+        deviceData.condemned = true; // This device is a bot. Condemn it.
+        if (onDeviceCompromised) {
+            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Triggered signed honeypot trap URL', score: 100, vector: { honeypotScore: 100 } });
+        }
+        await store.set(`device:${cookies.device_id}`, deviceData);
+        return { action: 'block', status: 403, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+    }
 
     if (isSuspicious && !isTicketValid(clientIp, powCookie)) {
         // --- CHALLENGE SOLUTION HANDLING ---
@@ -925,6 +1203,12 @@ class FingerprintEngine {
         // Store the secret with a short TTL (e.g., 5 minutes)
         await store.set(`secret:${nonce}`, clientSecret, 300);
 
+        // Associate the current challenge nonce with the device for trap URL verification later.
+        if (deviceData) {
+            deviceData.lastChallengeNonce = nonce;
+            await store.set(`device:${cookies.device_id}`, deviceData);
+        }
+
         if (logger) {
             logger({ type: 'challenge_issued', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now() });
         }
@@ -936,6 +1220,12 @@ class FingerprintEngine {
 
         // UNIFIED CHALLENGE LOGIC for all suspicion levels (low, medium, high)
         if (isSuspicious) { // Couvre à la fois low et medium
+            // Generate some trap URLs to embed in the challenge page.
+            // These links are visually hidden but present in the DOM to trap bots.
+            const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
+            const trapLinksHtml = trapUrls.map(url => `<a href="${url}" tabindex="-1">config</a>`).join(' ');
+
+
             const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path);
 
             // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
@@ -947,7 +1237,8 @@ class FingerprintEngine {
             const memDifficulty = Math.round(minMemDifficulty + memActivationFactor * (maxMemDifficulty - minMemDifficulty));
 
             // Always use the combined page, even if memory difficulty is 0 (it will be almost instant).
-            const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret);
+            const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;
+            const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret).replace('</body>', `${trapContainer}</body>`);
             return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 429, body: page };
         }
     }
@@ -992,12 +1283,16 @@ class FingerprintEngine {
     }
     await store.set(`ip:${clientIp}`, ipProfile);
 
-    const vector = await __internal.getSuspicionVector(requestContext);
+    const vector = await __internal.getSuspicionVector(requestContext, this.securityConfig); // Pass the config
+    const { honeypotScore } = getHoneypotScore(requestContext, this.securityConfig.honeypot);
+    const { requestPatternScore } = getRequestPatternScore(requestContext, (await store.get(`device:${requestContext.cookies?.device_id}`)), this.securityConfig.patterns);
     const score =
       vector.historyScore * (this.securityConfig.weights.historyScore || 0.3) +
       vector.rotationScore * (this.securityConfig.weights.rotationScore || 0.5) +
       vector.headerAnomalyScore * (this.securityConfig.weights.headerAnomalyScore || 0.1) +
-      vector.inconsistencyScore * (this.securityConfig.weights.inconsistencyScore || 0.8);
+      vector.inconsistencyScore * (this.securityConfig.weights.inconsistencyScore || 0.8) +
+      honeypotScore * (this.securityConfig.weights.honeypotScore || 0) +      
+      requestPatternScore * (this.securityConfig.weights.requestPatternScore || 0);
 
     if (score >= this.securityConfig.thresholds.high) return `suspicious_high:${clientIp}`;
     if (score >= this.securityConfig.thresholds.low) return `suspicious_medium:${clientIp}`; // Use medium for any suspicion
@@ -1028,6 +1323,7 @@ export const powMiddleware = (securityConfig) => {
       path: req.path,
       cookies: req.cookies,
       query: req.query,
+      body: req.body,
       headers: req.headers,
       isStatic: isStaticResource(req.path),
       // Add the newly required properties for full decoupling
@@ -1080,6 +1376,7 @@ export const __internal = {
     FingerprintBuilder, // Export for testing
     calculateTarget,
     FingerprintEngine, // Expose for advanced testing
+    getRequestPatternScore, // Expose for testing
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---
@@ -1114,9 +1411,11 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints) {
     // The "fitness" function evaluates the quality of a set of thresholds.
     // A lower score is better.
     const fitnessFunction = (solution) => {
-        const [low, medium, high] = solution;
+        const [low, medium, high, velocityThreshold, burstThreshold, scrapeThreshold] = solution;
         // Constraints: thresholds must be ordered and within a reasonable range.
-        if (low >= medium || medium >= high || low <= 10 || high >= 90) return Infinity;
+        if (low >= medium || medium >= high || low < 10 || high > 90) return Infinity;
+        // Constraints for pattern thresholds
+        if (velocityThreshold < 50 || velocityThreshold > burstThreshold || burstThreshold > scrapeThreshold) return Infinity;
 
         let falsePositives = 0; // Humans challenged unnecessarily.
         let falseNegatives = 0; // Undetected bots.
@@ -1133,12 +1432,21 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints) {
     };
 
     // Functions for the genetic algorithm.
-    const createIndividual = () => [10 + Math.random() * 20, 30 + Math.random() * 30, 60 + Math.random() * 30];
-    const crossover = (p1, p2) => [(p1[0] + p2[0]) / 2, (p1[1] + p2[1]) / 2, (p1[2] + p2[2]) / 2];
+    const createIndividual = () => [
+        10 + Math.random() * 20, // low
+        30 + Math.random() * 30, // medium
+        60 + Math.random() * 30, // high
+        100 + Math.random() * 150, // velocityThreshold (100-250ms)
+        300 + Math.random() * 400, // burstThreshold (300-700ms)
+        800 + Math.random() * 700, // scrapeThreshold (800-1500ms)
+    ];
+    const crossover = (p1, p2) => p1.map((val, i) => (val + p2[i]) / 2);
     const mutate = (s) => {
         const n = [...s];
-        const i = Math.floor(Math.random() * 3);
-        n[i] += (Math.random() - 0.5) * 5;
+        const i = Math.floor(Math.random() * n.length);
+        // Adjust mutation range based on parameter
+        const mutationRange = i < 3 ? 5 : 50;
+        n[i] += (Math.random() - 0.5) * mutationRange;
         return n;
     };
 
@@ -1148,16 +1456,26 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints) {
         populationSize: 40
     });
 
-    const [newLow, newMedium, newHigh] = result.solution;
+    const [newLow, newMedium, newHigh, newVelocity, newBurst, newScrape] = result.solution;
 
     // Update the configuration live.
-    securityConfig.thresholds = {
-        low: Math.round(newLow),
-        medium: Math.round(newMedium),
-        high: Math.round(newHigh)
-    };
+    // Ensure thresholds object exists
+    if (!securityConfig.thresholds) securityConfig.thresholds = {};
+    securityConfig.thresholds.low = Math.round(newLow);
+    securityConfig.thresholds.medium = Math.round(newMedium);
+    securityConfig.thresholds.high = Math.round(newHigh);
+
+    // Update pattern detection parameters
+    if (!securityConfig.patterns) securityConfig.patterns = {};
+    securityConfig.patterns.velocityThreshold = Math.round(newVelocity);
+    securityConfig.patterns.burstThreshold = Math.round(newBurst);
+    securityConfig.patterns.scrapeThreshold = Math.round(newScrape);
+    // Weights could also be optimized, but let's keep it to thresholds for now for simplicity.
 
     console.log("[AutoTuning] Nouveaux seuils optimisés appliqués :", securityConfig.thresholds);
+    if (securityConfig.patterns) {
+        console.log("[AutoTuning] Nouveaux paramètres de pattern appliqués :", securityConfig.patterns);
+    }
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
   "main": "fingerprint.js",
   "type": "module",
@@ -40,6 +40,7 @@
   },
   "homepage": "https://github.com/anonympins/fingerprint#readme",
   "devDependencies": {
+    "body-parser": "^1.20.2",
     "cookie-parser": "^1.4.6",
     "express": "^4.18.2",
     "vitest": "^4.1.11"